SSL: Algorithm constraints check failed
プラットフォームについて: Server および Data Center のみ。この記事は、Server および Data Center プラットフォームのアトラシアン製品にのみ適用されます。
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Fisheye および Crucible は除く
問題
After copying a cacerts file from an older version of a JDK or JRE, the following appears in the daily log file:
ERROR [clusterScheduler_Worker-3] c.a.c.d.DbCachingDirectoryPoller Error occurred while refreshing the cache for directory [ 458753 ].
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.CommunicationException: xxx.xxx.xxx.xxx:xxxx; nested exception is javax.naming.CommunicationException: xxx.xxx.xxx.xxx:xxxx [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA]
...
Caused by: org.springframework.ldap.CommunicationException: xxx.xxx.xxx.xxx:xxxx; nested exception is javax.naming.CommunicationException: xxx.xxx.xxx.xxx:xxxx [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA]
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:108) ~[spring-ldap-core-2.0.2.RELEASE.jar:2.0.2.RELEASE]
...
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_71]
...
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:352) ~[na:1.8.0_71]
...
Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed: MD5withRSA
at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135) ~[na:1.8.0_71]
診断
環境
- JDK/JRE has been updated, and an older cacerts file was copied into to new JDK/JRE path.
原因
During JVM releases, Oracle will update the cacerts file adding or removing security algorithms. The older cacerts file may not contain all of the expected certificates or algorithms used in the newer JVM
ソリューション
- Restore the original cacerts file to the newer JDK/JRE path.
Import your certificates into the new cacerts file
$JAVA_HOME/keytool -import -alias <server_name> -keystore $JAVA_HOME/lib/security/cacerts -file CERTIFICATE_FILE_NAMEアプリケーションを再起動します。
Last modified on Mar 30, 2016
Powered by Confluence and Scroll Viewport.